As we work to bring even more value to our audience, we’ve made important changes for those who receive Ad Age with our compliments. As of November 15, 2016 we will no longer be offering full digital access to AdAge.com. However, we will continue to send you our industry-leading print issues focused on providing you with what you need to know to succeed.

If you’d like to continue your unlimited access to AdAge.com, we invite you to become a paid subscriber. Get the news, insights and tools that help you stay on top of what’s next.

FTC to Marketers: Self-Regulate Behavioral Targeting

Questions Persist About Details and Enforcement of Agency's Online-Privacy Guidelines

WASHINGTON (AdAge.com) -- The Federal Trade Commission seemed to give a major victory to marketers today when it confirmed it will let them self-regulate behavioral-marketing privacy issues in cyberspace, rather than introduce government regulation. It also narrowed the scope of advertising that will face regulation.

The FTC unveiled the self-regulation endorsement and its privacy guidelines today as part of a 48-page report addressing concerns about behavioral targeting of advertising.

But instead of pleasing marketers, the report raised questions about how the agency might implement and enforce the guidelines. While the underlying idea is the industry will regulate itself, the guidelines act as a minimum standard.

"It creates an air of concern on potential enforcement," said Michael Zaneis, VP-public policy for the Interactive Advertising Bureau.

He said marketers could now face more FTC scrutiny, and some of the wording of the guidance leaves uncertain what the agency will require of media sellers and marketers. He also said there was concern about how long the self-regulation endorsement will stick, given that President Barack Obama is soon expected to name a new FTC chairman. Consumer groups, meanwhile, expressed hope that the new FTC chairman would alter the reliance on self-regulation.

Questioning self-regulation
One FTC commissioner, Pamela Jones Harbour, today questioned any use of self-regulation for dealing with behavioral-profiling issues. "The circumstances supporting appropriate and effective self-regulation are not present here," she wrote. She also expressed concern that the report is too narrowly focused on online advertising.

Another FTC commissioner, Jon Leibovitz, supported self-regulation but warned he wasn't endorsing current online-privacy practices. "I continue to be troubled about some companies' unfettered collection and use of consumers' sensitive data," he said, citing especially information gathered about children. Both called for marketers to do more.

The FTC report rejected many consumer groups' complaints about using self-regulation instead of government regulation to deal with profiling issues and most of their attempts to further limit marketers. It also narrowed the scope of marketers and media companies subject to the self-regulation guidelines.

The FTC said websites that deliver ads through contextual targeting -- such as a travel site featuring travel ads -- are in line with consumer expectations and aren't covered by the principles. It also drew a distinction between a site's own "first-party" activities, including creating behavioral profiles of its users and sharing the information it collects with other sites. The FTC said the self-regulatory principles apply only to shared information.

New language
Still, new language addressing concerns about marketers' profiling of sensitive information -- and the fact the agency is now effectively promulgating the guidance -- worried some media and marketing groups. They pointed to language in the guidance requiring "every website" collecting information for behavioral marketing to provide a privacy policy and give consumers a choice to opt out of tracking and the new language about sensitive information.

The FTC report says, "Financial data, data about children, health information, precise geographic location information and Social Security numbers are the clearest examples" of potentially sensitive information but there could be others.

"It creates a number of gray areas," Mr. Zaneis said. "It's a little ambiguous. The trigger on notice is a little unclear."

The FTC did step up some requirements for consumer notice in the report. The agency called the old standard for when marketers and media sellers had to offer consumers an opportunity to opt out of tracking -- when information was personally identifiable -- outdated. It said sites should offer the choice to opt out if the information can reasonably be tracked back to individual consumers or websites.

Mixed reactions
Google's senior policy counsel, Pablo Chavez, wrote on a company blog: "We agree with the [commissioners'] statements that individual companies and industry generally can and should do more to protect user privacy. Google will continue to engage in efforts to develop strong self-regulatory principles and will continue to advocate for comprehensive federal privacy legislation."

Nancy Hill, president-CEO of the American Association of Advertising Agencies, said she was "heartened by the FTC's continued understanding that the people best equipped to regulate this new technology are the practitioners who use it daily and are evolving it at seemingly warp speed."

"These are baby steps for privacy at best," said Jeff Chester, executive director of the Center for Digital Democracy. "The FTC failed to analyze and assess the range of data-collection techniques and platforms which use forms of behavioral targeting (social networks, online video, in-game, etc.) The first-party website exclusion, lack of definition for sensitive data and vague discussion of updating privacy policies reveal how inadequate the new FTC principles are."